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We show that every elliptic curve over a finite field of odd characteristic 
whose number of rational points is divisible by 4 is isogenous to an elliptic 
curve in Legendre form, with the sole exception of a minimal respectively max- 
imal elliptic curve. We also collect some results concerning the supersingular 
Legendre parameters. 



1. INTRODUCTION 

Throughout this paper, q > 1 denotes a power of an odd prime number 
p, and fc is a field. Given two elliptic curves E/k and E' /k, all morphisms 
from E to E' are understood to be defined over k. In particular, we simply 
write End(i?) for the ring of all endomorphisms of E/k. The notation 
E ^ E' indicates that E is isomorphic to E' , and E ^ E' means that E 
and E' are isogenous. The endomorphism of multiplication by m G Z on 
E is denoted by [m]. In case k = Fg, it is a well known fact (see [13]) that 
E ^ E' ii and only if |i?(Fg)| = |£"(Fq)|. The Frobenius endomorphism 
on an elliptic curve E/Fg will be denoted hy (p = (pg. 

For char(/(;) ^ 2 and A G fc \ {0,1}, the Legendre elliptic curve E\/k 
is given by the equation — x{x — l){x — X). All its 2-torsion points 
are rational. An arbitrary elliptic curve E/k with this property has an 
equation of the form j/^ = x{x — a){x — (3) with a, (3 £ k* (after a suitable 
choice of coordinates). Investigating the possible transformations (see [12, 
III §1]) yields that E is Legendre isomorphic (i.e., isomorphic to a Legendre 
elliptic curve) if and only if at least one of ±a, ±/3, ±(a — /3) is a square in 
k. This is always true when k{^/—\) is algebraically closed or when fc = Fq 
with (7 = 3 mod 4, but not, e.g., for fc = F13, a — —2 and /3 = 5. So 
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the next question to ask is whether E is isogenous to a Legendre eUiptic 
curve, or Legendre isogenous, for short. For k = Fq, this can be answered 
affirmatively, with precisely one exception, which occurs when g is a square. 

Theorem 1.1. Let E/Fq be an elliptic curve. Write q = r"^ , such that 
r = 1 mod 4 when q is a square. Then E is Legendre isogenous if and only 
i/|£(F,)|e4Z\{(r+in. 

A proof of this result will bo presented in the next section. In the third 
section we collect some results concerning the supersingular Legendre pa- 
rameters, i.e., the values of A e Fg for which E\ is supersingular. Section 4 
contains some remarks on the 'average' number [^^^(Fq)! when A ranges 
over Fg \ {0, 1}, and the final section considers an analogue in characteris- 
tic 2. 

Our motivation for studying this originated from the problem of finding 
lower bounds for the maximum number Nq{2>) of rational points on genus 
3 curves over F^. For example, we have used the main result of the present 
paper to prove N^n{?>) > 3" + 6\/3" — 11 for every n > 1. We plan to 
present this and similar results in a forthcoming paper. 

2. ISOGENIES OF LEGENDRE ELLIPTIC CURVES 

In this section we assume the characteristic of k to be different from 2. 

Lemma 2.1. Let E/k he given by y^ — {x — a){x — f3){x — 7) with 
a,f3,'y e k, a f3 ^ a. Then {^,0) e [2]E{k) <^ 7-0,7-/? e fc*^. 

Proof. This is true because the homomorphism (see [9, Thm. 1.2] and 

[12, X §1]) 

{x-a,x-P,x-j): E{k) k*/k*^ x k*/k*^ x k*/k*^ 

has kernel [2]iJ(fc) and sends (7, 0) to (7 — a, 7 — (3, (7 — a) (7 — /3)). | 

Given an elliptic curve E/k with Weierstrass equation = f{x) and 
an element a € fc*, we denote by E'^"'^ /k the elliptic curve with equation 
Q^y^ = f{x)- Note that E ~ for a e k*"^ . If E/Fq and a is non-square 
in Fg, then counting points by means of the quadratic character on F, 
yields \E{Fq)\ + |£(«)(F,)| =2^ + 2. 

Lemma 2.2. Let E/k he a,n elliptic curve, and let a G fc* he non-square. 
Suppose E ~ E^°'K Then j{E) = 1728 and k{y/a) = k{y^). 
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Proof. This can be seen from a calculation using the explicit form of a 
possible isomorphism (see [12, III §1 and Appendix A]). Alternatively, one 

may use the theory of twisting ([12, X §5]): the condition E ~ i?*^"^ implies 
that the cocycle a i-^ [a{^/a) / ^/a\ is trivial in {Gal(k / k) , Aut{E (g) fc)), 
and hence of the form a i— > a{(p)oip~^ for some ip € Aut{E(^k). Then ip has 

order 4, from which the lemma easily follows. | 

Let us return to the Legendre elliptic curves E\/k with AgA:\{0,1}. 
It is well known (see [12, III §1]) that E\ (S) k — E^ (g) if and only if 
Ij G [A] := {A, 1 - A, 1/A, 1 - 1/A, 1/(1 - A), A/(A- 1)}, the orbit of A under 
the group generated by the two transformations A i— > 1/A and A i— > 1 — A 
on 

Proposition 2.1. Lei A e \ {0, 1, -1, 2, 1/2}. The following condi- 
tions are equivalent. 

(a) Ex ~ Efj_ over Fg for all n e [A] . 

(b) -l,A,l-AeFf. 

(c) £;a[4](F,)~Z/4Zx Z/4Z. 

If E^"^ /Fq is not Legendre isomorphic for some a € F*, then the above 
conditions are satisfied. 

Proof. Since —1 ^ [A], we know that j{E\) ^ 1728. From Lemma 2.2 

and the isomorphisms i?^"^^ ^ Ei-\, E^x ^ ~ Ei/x and E^^~'^^ ~ Ex/(x-i) 
one concludes (a) <;4> (b). The equivalence of (b) and (c) follows directly 
from Lemma 2.1. 

If e[^^ is not Legendre isomorphic, then a must be non-square, and none 

of the curves e'^^^ , e''^^ and iJ^^^^-* is isomorphic to E^^ since they are all 
Legendre isomorphic. This implies (again using Lemma 2.2) that —1, A, l — 
A e Ff . I 

Proposition 2.2. Let p' = {-l)^P~^^/'^p and suppose Ex/Fg is super- 
singular. Then A e Fp2 and Ex{Fp2) ~ Z/{p' - 1)Z x Z/(p' - 1)Z. 

Proof. Since Ex is supersingular, it has j-invariant j := j{Ex) € Fp2 (cf. 
[12, V Theorem 3.1]). Hence there exists an elliptic curve E/Fpi such that 
Ex®Fp ~ E(E)Fp. Multiplication by p on E' is purely inseparable of degree 
p^ = deg <j) (again [12, V Theorem 3.1]), and therefore it factors as [p] = 
for some automorphism ip of E. Assuming j ^ 0, 1728 for a moment implies 
^ = [±1], hence (j) = [±p] and E{Fp2) = E[l - (/-](Fp) = E[p±l]{Fp) ~ 
(Z/(p ± 1)Z)^. As p ± 1 is even, E has an equation y-^ = x{x — a){x — (3) 
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with a,/3 G F*2. From E^°''> ~ E/^/^ we conclude /3/a G [A] and therefore 
A e Fp2. For j e {0, 1728}, the latter fact follows from an easy calculation. 

Therefore wc may consider E\/Fp2. Comparing the list in [14, p. 536] 
(see also [15]) with the condition |i?A(Fp2)| e 4Z leaves us with the cases 

|£^A(Fp2)| = (p± 1)2, so E[''\Fp2) ~ (Z/(p' - 1)Z)2 for suitable a e F;,. 

Nowp' — 1 = mod 4, which means in particular that (0, 0) G [2]i?^"^(Fp2). 
By Lemma 2.1, this implies — a G F*i. Hence also a is a square in F*2 and 

thus Ex E^"\ | 

We are now ready to complete the 

Proof of Theorem 1.1. First of all, E Ex for some A G F, \ {0, 1} 
implies [^^(Fq)! = |i?A(Fg)| G 4Z since Ex{Fq) contains the whole 2-torsion 
subgroup. Moreover, if g is a square and Ex is supersingular, then (j) = [r] 
on Ex/Fg by Proposition 2.2, and so |-Ea(F,)| ^ (r + 1)^. 

To show the opposite direction, wc suppose [^^(Fq)! G4Z\{(r + l)2} 
for the rest of the proof. If E does not have all its 2-torsion rational, then 
£'(F,) must contain a point P of order 4. Choose Q G £^[2](Fp) \ ([2]P). 
Then (t)g{Q) = Q mod [2]P, and so = E/{[2]P) does have rational 2- 
torsion ^[2](Fg) = (P mod [2]P,Q mod [2]P) ~ Z/2Z x Z/2Z, generated 
by the images of P and of Q in E/ ([2]P). We therefore may assume that 
E is given by an equation y"^ = x{x — a){x — f3) with a, (3 G F*. Hence 
~ Ex with A := /3/a. 

Let us first assume that E is supersingular. Once more investigating 
the Hst in [14, p. 536] yields either |£'(Fg)| = g' + 1 with non-square q, or 
|ii^(Fq)| = (r ± 1)2 with q a square. In the first case wc have |i?(Fg)| = 
|£''^")(Fg)|, hence E ~ E'-'^\ which implies the theorem. In the second 
case, we must have E ~ E^"^ c± Ex by Proposition 2.2. 

Now suppose E is ordinary. If E^^ is Legendre isogenous, the theorem is 
proven. Otherwise we may assume [4] (Fg) ~ Z/4Zx Z/4Z and -1 G F*^ 
by Proposition 2.1. Using Riick's theorem [8], we conclude that Ex ~ E' 
where E'/Fg is an elliptic curve with £"[4](F,) ~ Z/4Z x Z/2Z. Clearly 
we can choose the coordinates such that E' has an equation = x{x — 
a'){x - 15') with a',/3' G F* and (0,0) G [2\E'{Fq). But then -a' G Ff 

by Lemma 2.1. Thus E' ~ Ex' with A' = 0'/a', and this time E["^/Fg is 
Legendre isomorphic according to Proposition 2.1. 
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3. SUPERSINGULAR LEGENDRE PARAMETERS 

From Proposition 2.2, we see that not only the supersingular j-invariants 
but even the supersingular Legendre parameters are in Fp2. This is well 
known; compare [3, pp. 94, 97]. The proof of Proposition 2.2 moreover 
shows that these supersingular Legendre parameters are squares in F*2. 
One can prove an even stronger result which also seems to be well known. 
See [1, Theorem 1.9A] for a statement of the results in this section; Brock's 
approach is rather different from the one presented hero. 

Proposition 3.1. Let A e Fg \ {0,1} such that Ex is supersingular. 
Then -Xe Fit 



Proof. By Proposition 2.2, we have A <= Fp2 and Ex{Fp2) ~ (Z/(p' - 
1)Z)^ with p' :— (— l)(P^^'/^p = 1 mod 4. In particular, condition (c) of 
Proposition 2.1 is satisfied with q = p^, hence A G F*2. Let us fix square 
roots \/A, =: i G Fp2. By [12, III Example 4.5], E = Ex/{{0,0)) 

has an equation y"^ = x{x + (\/A + l)^){x + {VX - 1)^), so Ex E E^ 
with A := {^^y. Because E^_ ; is supersingular, too, we can conclude 

1 — A = ( ^'_^ )^-\/A e F*2. This shows that A is a fourth power in Fp2. 
Applying this result to 1 — A instead of A yields 

^' (rTiF"(^-i)^ ^ 

The point P := (\/A,i(A - \/A)) e Ex{Fp2) has order 4, namely [2]P = 
(0, 0). As in the proof of Lemma 2.1, the group homomorphism 

{x,x-l,x-X): E{Fp2) ^ F*p2/F*p^ x F*p2/F*p^ x F*p2/F*p^ 

has kernel [2]E{Fp2) and sends P to (a/A, VX — 1, VX — A). Together with 
(*) we obtain the equivalence 

-iGF;f ^ i6|p2_i = (p'_i)(p' + i) 

p' = 1 mod 8 ^ P e [2]£;A(Fp2) 

^ Va - 1 e f;? ^ A e f;! . 

Since we already knew that A e F*t, the desired result drops out. | 

Recall from [2] and [6] that the supersingular Legendre parameters are 
exactly the m := (p— 1)/2 distinct roots of the Deuring polynomial Hp{x) = 
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(-l)'"Er=o (T)^^;*^ e Fp[x]. Thus Proposition 3.1 says that Hp{-x) di- 
vides x^p'-i)/^ - 1. 



Concerning the number Sp := |{A e Fp : -Hp (A) = 0}| of supersingular 
Legendre parameters in Fp, we have the following. Write h{—p) for the 
class number of (the ring of integers in) Q(-y/— p). 



Proposition 3.2. The number Sp of supersingular Legendre parameters 
in Fp satisfies 

(a) Sp = if and only if p=l mod 4. 

(b) S3 = 1. 

(c) Ifp = 3 mod 4 and p> 3, then Sp = 3h{—p). 
In the proof, the following lemma will be used. 

Lemma 3.1. Assume p > 3 and q = 3 mod 4, and let E/Fq be an elliptic 
curve with j-invariant j{E) ^0. If E is Legendre isomorphic, then there 
are exactly 3 values o/ A e Fg \ {0, 1} such that E c:i E\. 

Proof Note that E^~^^ ~ Ei^x and e[^1^ ~ £^i-i/a and E[j^l_^^ ~ 
■E'A/(A-i)- Assume j := j{E\) ^ 0,1728 for the moment. Then [A] has 
6 elements and, using Lemma 2.2, exactly one from each pair {A, 1 — A}, 
{1/A, 1 — 1/A} and {1/(1 — A), A/(A — 1)} yields a curve isomorphic to E\ 
over Fq. 

The remaining case j = 1728 corresponds to A e {—1,2,1/2}. These 
three values are different since wc; assume the characteristic to be > 3. The 
curves E_x and E-i are obviously isomorphic. Moreover, i?2 — £^1/2 — 
e'^~i1^ ~ £'2"^^- Since q = 3 mod 4, one of 2, —2 is a square in F*, hence 
iJi/2 — El, and again we find 3 values of A € Fg \ {0, 1} giving the same 



Proof of Proposition 3.2. (b) holds because H3{x) = —x — 1. We now 
assume p > 3. Then a supersingular elliptic curve over Fp has p+1 rational 
points. For p = 1 mod 4 this number is not divisible by 4. Therefore, 
Sp = in this case. Since Sp > when p = 3 mod 4 (this follows from 
^p(~l) = foi' such p, or alternatively, from the fact that Hp has odd 
degree when p = 3 mod 4, while all irreducible factors have degree < 2 by 
Proposition 2.2), (a) follows. 

To prove (c), consider a supersingular elliptic curve E/Fp with 3 < p = 
3 mod 4. Since = [-p] on E/Fp, we have Z[v^ - Z[(6] C End(£). 
Now End(i^) is commutative (since all Fp-endomorphisms by definition 
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commute with and End{E (g) F^) has rank 4), and therefore End{E) C 

Z[-!— ^^]. Prom this, one concludes that End(£') ~ Z[^—^^], the ring 
of integers in C^{^/—p), precisely when 1 — (/) is divisible by 2 in End(i?), 
which happens if and only if cf) acts trivially on £'[2](Fj,), in other words, if 
and only if all 2-torsion on E is Fp-rational. In particular, a supersingular 
Ex/Fp satisfies End(^A) ^ Zf ^""^ ]. 

Conversely, if an elliptic curve E/Fp satisfies End(£') ~ Z[ ^~'^~^ -], then 
E is supersingular (the trace of an element of norm p is divisible by p in 
the latter ring), and by the argument above, there are a, /3 e F* such that 

E can be given by an equation = x{x — a){x — fi). Hence E ~ ^^fa — 

-E'll^/a- Since p = 3 mod 4, one of a, —a is a square in F*, and we conclude 
that E is Legendre isomorphic. Moreover, j{E) ^ because otherwise 
p = 2 mod 3 by supersingularity, while to have all 2-torsion rational one 
would need p = I mod 3. Hence Lemma 3.1 applies, and we find precisely 
3 values of A e Fp \ {0, 1} for which E ~ Ex. 

The conclusion is that the number Sp of supersingular values of A G Fj, 
equals 3 times the number of Fp-isomorphism classes of elliptic curves E/Fp 
with End(£;) ~ Z[ ^~^ ]. By [14, Thm. 4.5] (compare [10, p. 194] where 
a small correction is given), the latter number equals h{—p). 



It is known that h{-p) > ^ log(p) ([5, p. 232], [7, p. 321]). Hence, in 
particular. Proposition 3.2 implies that for p = 3 mod 4, the number of 
Fp-rational zeroes of Hp tends to infinity when p — > oo. 

4. SOME STATISTICS CONCERNING LEGENDRE 
ELLIPTIC CURVES 

We will briefly discuss some statistical observations concerning the num- 
bers \Ex{Fq)\. First of all, these are integers = mod 4, and by the Hasse 
inequality, they lie in the interval [q+1 — 2yg, q+l + 2y/q]. Moreover, if 
an integer N = q + 1 — t in this interval does not occur as the number of 
points of some elliptic curve over Fg, then gcd(t, q) i= I (sec [14, Thm. 4.1]; 
in fact this reference for given q even precisely describes the remaining at 
most 5 values of t with gcd(t, q) ^ I for which an elliptic curve over Fq with 
N points exists). It follows that there are roughly ^{l — 1/p) numbers 
= mod 4 which appear as the number of points of some elliptic curve 
over Fg. By our main theorem, all but at most one of these appear as 
the number of points of some Ex/Fq. Since there are q — 2 elliptic curves 
Ex/Fq, this implies that 'on average' there arc roughly ]3y/g/(p — 1) values 
of A G Fg \ {0, 1} such that ]i^A(Fg)l equals a given occurring N. 
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If the numbers |ii^A(F9)| had an average of q -\- 1 over all A G Fg \ {0, Ij-, 
then 

S{q) := I^^(F<^)I 
AeF,\{o,i} 

would equal S{q) := {q — 2){q + 1) = — q — 2. But this is impossible for 
q = l mod 4 because then S{q) = 2 mod 4. 

Proposition 4.1. S'(g) = S{q) + 1 + 



Proof. This can by shown by naively computing 



~S{q) := \{{x,y,X)eF^g:y^ =xix-l){x-X)}\ 

= 2q+\Fg\{0,l}xFg\^q^ 
So{q) ■■= \{ix,y)GFl:y^=x'{x-l)}\ 

Ff \{-l} =g-(-l)(«-i)/2 and 

S,{q) := \{{x,y)GFl.y^=x{x-lf}\=2 + 2Ff\{l} 



= q-l. 



Then Siq) = q-2 + S{q) - So{q) - Siiq) = q^ - q - I + (-!)(«- 



l)/2 



I 



An alternative method for computing S(q) is by considering the rational 
elliptic surface X ^ corresponding to the Legendrc family over the 
A-line. Compare [4, p. 56] for similar calculations. The surface X has fibre 
X\ = E\ over AeFq\{0,l}. Over A = 1 the fibre Xi consists of two 
P^'s meeting in two rational points. Hence |Xi(Fq)| = 2q. Over A = the 
fibre Xq also consists of two copies of meeting in two points; however, 
these points are rational precisely when —1 is a square in Fq. This implies 
|Xo(Fg)| ^2q + l- i-iy"-^^/^. Finally, the fibre X^ is of Kodaira type 
I2 and \Xa 



,(Fq)| = 7q + 1. The Lefschetz trace formula now shows that 



\X{F,)\: 

\Xoo{Fq) 



q^ + Wq- 



1 and hence S{q) 
l + (_l)(9-i)/2. 



\X{Fq)\-\Xo{Fq)\-\X,{Fq)\ 



5. AN ANALOGUE IN CHARACTERISTIC TWO 

For the sake of completeness, we consider the situation in characteristic 2. 
Let n e N. For each A G F^,., we have the elliptic curve E\/F2^ given 
by the equation y'^ -\- xy = + A. Since j{E\) = 1/A, they are mutually 
non-isomorphic. 

Proposition 5.1. An elliptic curve E/F2n satisfies |£'(F2n)| g 4Z if 
and only if E 2:^ Ex for some A G Fjn . 
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Proof. Recall that E/F2n is ordinary, i.e., |i?(F2»i)| G 2Z, if and only 
if (after a suitable choice of coordinates) it has an equation y'^ + xy = 

+ (ix^ + A with /3 e and A G F^„, and then j{E) = 1/A (see [12, 
Appendix A]). Thus we may assume that E has such an equation. For 
a € F2" , wc denote by E^"^ the elliptic curve with equation y"^ + xy — 
x^ + {a + l3)x^ + A. Then E ~ if and only if Tr(a) = 0, where Tr 
denotes the trace from F2r> to F2. Otherwise E^"^ is a quadratic twist 
of E and |i;(F2-)| + |£(")(F2")| = 2"+^ + 2 = 2 mod 4. It therefore 
remains to verify that £'a(F2") G 4Z. Treating the point at infinity and 
(0, VX) G Ex{F2n) separately, and dividing the equation by x'^, we obtain 
\Ex(F2n)\ = 2 + 2N with 

N = |{a; G F5„ : Tr(a; + A/x2) = 0}| 
= {xG F;„ : Tr(a;) = Ti:{VX/x)} , 

which is odd because x 1— > VX/x is an involution on F2» with precisely one 
fixed point. | 

Applying the Frobenius isogeny (j)2 to E\ results in the curve Ex^ . Putting 
^ = X and r] = y + X, one finds that Ex^ can be given by the equation 
f]^ + ^T] = ^'^ + X^. For this equation, a result like the one given above can 
be found in a paper by Schoof and van der Vlugt [11, p. 172]. 
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